CVE-2024-5809: 
WordPress vulnerability analysis and mitigation

The WP Ajax Contact Form WordPress plugin versions 2.2.2 and below contain a Reflected Cross-Site Scripting (XSS) vulnerability, identified as CVE-2024-5809. The vulnerability was discovered and publicly disclosed on July 9, 2024, by security researcher Bob Matyas (WPScan).

The vulnerability stems from the plugin's failure to properly sanitize and escape a parameter before outputting it back in the page. This security flaw has been assigned a CVSS score of 7.1 (High) and is classified under CWE-79. The vulnerability aligns with the OWASP Top 10 category A7: Cross-Site Scripting (XSS) (WPScan).

This vulnerability could be exploited against administrative users of WordPress sites running the affected plugin versions. When successfully exploited, it allows for reflected cross-site scripting attacks, potentially enabling attackers to execute malicious scripts in the context of the admin user's browser session (WPScan).

Currently, there is no known fix available for this vulnerability. Users of the WP Ajax Contact Form plugin should consider implementing additional security measures or potentially switching to alternative contact form solutions until a patch is released (WPScan).